nox-openclaw-hunter 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +140 -0
- package/bin/nox.js +2 -0
- package/dist/branding.d.ts +39 -0
- package/dist/branding.d.ts.map +1 -0
- package/dist/branding.js +66 -0
- package/dist/branding.js.map +1 -0
- package/dist/cli.d.ts +15 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +94 -0
- package/dist/cli.js.map +1 -0
- package/dist/commands/export.d.ts +21 -0
- package/dist/commands/export.d.ts.map +1 -0
- package/dist/commands/export.js +616 -0
- package/dist/commands/export.js.map +1 -0
- package/dist/commands/index.d.ts +8 -0
- package/dist/commands/index.d.ts.map +1 -0
- package/dist/commands/index.js +8 -0
- package/dist/commands/index.js.map +1 -0
- package/dist/commands/isolate.d.ts +30 -0
- package/dist/commands/isolate.d.ts.map +1 -0
- package/dist/commands/isolate.js +547 -0
- package/dist/commands/isolate.js.map +1 -0
- package/dist/commands/purge.d.ts +22 -0
- package/dist/commands/purge.d.ts.map +1 -0
- package/dist/commands/purge.js +295 -0
- package/dist/commands/purge.js.map +1 -0
- package/dist/commands/scan.d.ts +23 -0
- package/dist/commands/scan.d.ts.map +1 -0
- package/dist/commands/scan.js +155 -0
- package/dist/commands/scan.js.map +1 -0
- package/dist/detector/app-bundle.d.ts +13 -0
- package/dist/detector/app-bundle.d.ts.map +1 -0
- package/dist/detector/app-bundle.js +27 -0
- package/dist/detector/app-bundle.js.map +1 -0
- package/dist/detector/cli-binary.d.ts +12 -0
- package/dist/detector/cli-binary.d.ts.map +1 -0
- package/dist/detector/cli-binary.js +66 -0
- package/dist/detector/cli-binary.js.map +1 -0
- package/dist/detector/config.d.ts +21 -0
- package/dist/detector/config.d.ts.map +1 -0
- package/dist/detector/config.js +337 -0
- package/dist/detector/config.js.map +1 -0
- package/dist/detector/detection-config.d.ts +24 -0
- package/dist/detector/detection-config.d.ts.map +1 -0
- package/dist/detector/detection-config.js +242 -0
- package/dist/detector/detection-config.js.map +1 -0
- package/dist/detector/docker.d.ts +10 -0
- package/dist/detector/docker.d.ts.map +1 -0
- package/dist/detector/docker.js +94 -0
- package/dist/detector/docker.js.map +1 -0
- package/dist/detector/index.d.ts +50 -0
- package/dist/detector/index.d.ts.map +1 -0
- package/dist/detector/index.js +155 -0
- package/dist/detector/index.js.map +1 -0
- package/dist/detector/network.d.ts +34 -0
- package/dist/detector/network.d.ts.map +1 -0
- package/dist/detector/network.js +205 -0
- package/dist/detector/network.js.map +1 -0
- package/dist/detector/process.d.ts +16 -0
- package/dist/detector/process.d.ts.map +1 -0
- package/dist/detector/process.js +47 -0
- package/dist/detector/process.js.map +1 -0
- package/dist/detector/service.d.ts +17 -0
- package/dist/detector/service.d.ts.map +1 -0
- package/dist/detector/service.js +51 -0
- package/dist/detector/service.js.map +1 -0
- package/dist/enforcer/docker-cleaner.d.ts +30 -0
- package/dist/enforcer/docker-cleaner.d.ts.map +1 -0
- package/dist/enforcer/docker-cleaner.js +163 -0
- package/dist/enforcer/docker-cleaner.js.map +1 -0
- package/dist/enforcer/file-remover.d.ts +34 -0
- package/dist/enforcer/file-remover.d.ts.map +1 -0
- package/dist/enforcer/file-remover.js +137 -0
- package/dist/enforcer/file-remover.js.map +1 -0
- package/dist/enforcer/index.d.ts +33 -0
- package/dist/enforcer/index.d.ts.map +1 -0
- package/dist/enforcer/index.js +142 -0
- package/dist/enforcer/index.js.map +1 -0
- package/dist/enforcer/process-killer.d.ts +18 -0
- package/dist/enforcer/process-killer.d.ts.map +1 -0
- package/dist/enforcer/process-killer.js +80 -0
- package/dist/enforcer/process-killer.js.map +1 -0
- package/dist/enforcer/service-stopper.d.ts +23 -0
- package/dist/enforcer/service-stopper.d.ts.map +1 -0
- package/dist/enforcer/service-stopper.js +95 -0
- package/dist/enforcer/service-stopper.js.map +1 -0
- package/dist/index.d.ts +6 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +10 -0
- package/dist/index.js.map +1 -0
- package/dist/isolator/firewall.d.ts +25 -0
- package/dist/isolator/firewall.d.ts.map +1 -0
- package/dist/isolator/firewall.js +114 -0
- package/dist/isolator/firewall.js.map +1 -0
- package/dist/isolator/index.d.ts +63 -0
- package/dist/isolator/index.d.ts.map +1 -0
- package/dist/isolator/index.js +201 -0
- package/dist/isolator/index.js.map +1 -0
- package/dist/isolator/lockdown.d.ts +22 -0
- package/dist/isolator/lockdown.d.ts.map +1 -0
- package/dist/isolator/lockdown.js +401 -0
- package/dist/isolator/lockdown.js.map +1 -0
- package/dist/isolator/quarantine.d.ts +39 -0
- package/dist/isolator/quarantine.d.ts.map +1 -0
- package/dist/isolator/quarantine.js +364 -0
- package/dist/isolator/quarantine.js.map +1 -0
- package/dist/mdm/index.d.ts +93 -0
- package/dist/mdm/index.d.ts.map +1 -0
- package/dist/mdm/index.js +414 -0
- package/dist/mdm/index.js.map +1 -0
- package/dist/mdm/intune.d.ts +69 -0
- package/dist/mdm/intune.d.ts.map +1 -0
- package/dist/mdm/intune.js +409 -0
- package/dist/mdm/intune.js.map +1 -0
- package/dist/mdm/jamf.d.ts +58 -0
- package/dist/mdm/jamf.d.ts.map +1 -0
- package/dist/mdm/jamf.js +441 -0
- package/dist/mdm/jamf.js.map +1 -0
- package/dist/mdm/jumpcloud.d.ts +73 -0
- package/dist/mdm/jumpcloud.d.ts.map +1 -0
- package/dist/mdm/jumpcloud.js +470 -0
- package/dist/mdm/jumpcloud.js.map +1 -0
- package/dist/mdm/templates/detect.ps1.d.ts +30 -0
- package/dist/mdm/templates/detect.ps1.d.ts.map +1 -0
- package/dist/mdm/templates/detect.ps1.js +463 -0
- package/dist/mdm/templates/detect.ps1.js.map +1 -0
- package/dist/mdm/templates/detect.sh.d.ts +30 -0
- package/dist/mdm/templates/detect.sh.d.ts.map +1 -0
- package/dist/mdm/templates/detect.sh.js +474 -0
- package/dist/mdm/templates/detect.sh.js.map +1 -0
- package/dist/mdm/templates/enforce.ps1.d.ts +33 -0
- package/dist/mdm/templates/enforce.ps1.d.ts.map +1 -0
- package/dist/mdm/templates/enforce.ps1.js +681 -0
- package/dist/mdm/templates/enforce.ps1.js.map +1 -0
- package/dist/mdm/templates/enforce.sh.d.ts +33 -0
- package/dist/mdm/templates/enforce.sh.d.ts.map +1 -0
- package/dist/mdm/templates/enforce.sh.js +591 -0
- package/dist/mdm/templates/enforce.sh.js.map +1 -0
- package/dist/platform/darwin.d.ts +6 -0
- package/dist/platform/darwin.d.ts.map +1 -0
- package/dist/platform/darwin.js +192 -0
- package/dist/platform/darwin.js.map +1 -0
- package/dist/platform/index.d.ts +43 -0
- package/dist/platform/index.d.ts.map +1 -0
- package/dist/platform/index.js +27 -0
- package/dist/platform/index.js.map +1 -0
- package/dist/platform/linux.d.ts +6 -0
- package/dist/platform/linux.d.ts.map +1 -0
- package/dist/platform/linux.js +134 -0
- package/dist/platform/linux.js.map +1 -0
- package/dist/platform/windows.d.ts +6 -0
- package/dist/platform/windows.d.ts.map +1 -0
- package/dist/platform/windows.js +134 -0
- package/dist/platform/windows.js.map +1 -0
- package/dist/reporter/console.d.ts +27 -0
- package/dist/reporter/console.d.ts.map +1 -0
- package/dist/reporter/console.js +431 -0
- package/dist/reporter/console.js.map +1 -0
- package/dist/reporter/index.d.ts +11 -0
- package/dist/reporter/index.d.ts.map +1 -0
- package/dist/reporter/index.js +13 -0
- package/dist/reporter/index.js.map +1 -0
- package/dist/reporter/json.d.ts +61 -0
- package/dist/reporter/json.d.ts.map +1 -0
- package/dist/reporter/json.js +75 -0
- package/dist/reporter/json.js.map +1 -0
- package/dist/reporter/webhook.d.ts +57 -0
- package/dist/reporter/webhook.d.ts.map +1 -0
- package/dist/reporter/webhook.js +230 -0
- package/dist/reporter/webhook.js.map +1 -0
- package/dist/types/config.d.ts +116 -0
- package/dist/types/config.d.ts.map +1 -0
- package/dist/types/config.js +6 -0
- package/dist/types/config.js.map +1 -0
- package/dist/types/detection.d.ts +85 -0
- package/dist/types/detection.d.ts.map +1 -0
- package/dist/types/detection.js +5 -0
- package/dist/types/detection.js.map +1 -0
- package/dist/types/enforcement.d.ts +33 -0
- package/dist/types/enforcement.d.ts.map +1 -0
- package/dist/types/enforcement.js +5 -0
- package/dist/types/enforcement.js.map +1 -0
- package/dist/types/index.d.ts +8 -0
- package/dist/types/index.d.ts.map +1 -0
- package/dist/types/index.js +8 -0
- package/dist/types/index.js.map +1 -0
- package/dist/types/isolation.d.ts +55 -0
- package/dist/types/isolation.d.ts.map +1 -0
- package/dist/types/isolation.js +5 -0
- package/dist/types/isolation.js.map +1 -0
- package/dist/utils/exec.d.ts +48 -0
- package/dist/utils/exec.d.ts.map +1 -0
- package/dist/utils/exec.js +103 -0
- package/dist/utils/exec.js.map +1 -0
- package/dist/utils/fs.d.ts +34 -0
- package/dist/utils/fs.d.ts.map +1 -0
- package/dist/utils/fs.js +111 -0
- package/dist/utils/fs.js.map +1 -0
- package/dist/utils/index.d.ts +7 -0
- package/dist/utils/index.d.ts.map +1 -0
- package/dist/utils/index.js +7 -0
- package/dist/utils/index.js.map +1 -0
- package/dist/utils/logger.d.ts +14 -0
- package/dist/utils/logger.d.ts.map +1 -0
- package/dist/utils/logger.js +48 -0
- package/dist/utils/logger.js.map +1 -0
- package/docs/intune.md +390 -0
- package/docs/jamf.md +400 -0
- package/docs/jumpcloud.md +510 -0
- package/package.json +65 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Nox Security
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,140 @@
|
|
|
1
|
+
```
|
|
2
|
+
███╗ ██╗ ██████╗ ██╗ ██╗
|
|
3
|
+
████╗ ██║██╔═══██╗╚██╗██╔╝
|
|
4
|
+
██╔██╗ ██║██║ ██║ ╚███╔╝
|
|
5
|
+
██║╚██╗██║██║ ██║ ██╔██╗
|
|
6
|
+
██║ ╚████║╚██████╔╝██╔╝ ██╗
|
|
7
|
+
╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝
|
|
8
|
+
```
|
|
9
|
+
|
|
10
|
+
# OpenClaw Hunter
|
|
11
|
+
|
|
12
|
+
**Hunt, purge, and isolate OpenClaw AI agents across your fleet.**
|
|
13
|
+
|
|
14
|
+
---
|
|
15
|
+
|
|
16
|
+
## Installation
|
|
17
|
+
|
|
18
|
+
```bash
|
|
19
|
+
npm install -g nox-openclaw-hunter
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
Or from source:
|
|
23
|
+
|
|
24
|
+
```bash
|
|
25
|
+
git clone https://github.com/Arampc/Nox-OpenClaw-Hunter.git
|
|
26
|
+
cd Nox-OpenClaw-Hunter
|
|
27
|
+
npm install && npm run build && npm link
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
> Requires Node.js 18+
|
|
31
|
+
|
|
32
|
+
---
|
|
33
|
+
|
|
34
|
+
## Commands
|
|
35
|
+
|
|
36
|
+
### `nox scan`
|
|
37
|
+
|
|
38
|
+
Hunt for OpenClaw installations on the system.
|
|
39
|
+
|
|
40
|
+
```bash
|
|
41
|
+
nox scan # Scan current user
|
|
42
|
+
nox scan --all-users # Scan all users (requires sudo)
|
|
43
|
+
nox scan --json # Output as JSON
|
|
44
|
+
nox scan --yaml # Output as YAML
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
### `nox purge`
|
|
48
|
+
|
|
49
|
+
Purge all OpenClaw components from the system.
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
nox purge --dry-run # Preview what will be purged
|
|
53
|
+
sudo nox purge # Execute purge
|
|
54
|
+
sudo nox purge --force # Skip confirmation
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
### `nox isolate`
|
|
58
|
+
|
|
59
|
+
Isolate the device by blocking ports, quarantining files, and preventing reinstallation.
|
|
60
|
+
|
|
61
|
+
```bash
|
|
62
|
+
nox isolate --dry-run # Preview isolation actions
|
|
63
|
+
sudo nox isolate # Apply isolation
|
|
64
|
+
sudo nox isolate revert # Revert isolation
|
|
65
|
+
nox isolate list # List quarantined items
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
### `nox export`
|
|
69
|
+
|
|
70
|
+
Generate MDM deployment scripts for fleet-wide hunting.
|
|
71
|
+
|
|
72
|
+
```bash
|
|
73
|
+
nox export --platform jamf --mode detect
|
|
74
|
+
nox export --platform intune --mode purge
|
|
75
|
+
nox export --platform jumpcloud --mode detect --webhook https://siem.example.com
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
**Supported platforms:** `jamf`, `intune`, `jumpcloud`
|
|
79
|
+
|
|
80
|
+
---
|
|
81
|
+
|
|
82
|
+
## What It Detects
|
|
83
|
+
|
|
84
|
+
| Component | Detection Method |
|
|
85
|
+
|-----------|------------------|
|
|
86
|
+
| CLI Binary | Known paths, `which` lookup |
|
|
87
|
+
| App Bundle | `/Applications/OpenClaw.app` (macOS) |
|
|
88
|
+
| Config | `~/.openclaw`, `~/.clawdbot`, `~/.moltbot` |
|
|
89
|
+
| Gateway | TCP port scan (auto-detects port) |
|
|
90
|
+
| Processes | Process name matching |
|
|
91
|
+
| Service | `launchctl` / `systemctl` / `sc` |
|
|
92
|
+
| Docker | Containers and images |
|
|
93
|
+
|
|
94
|
+
---
|
|
95
|
+
|
|
96
|
+
## Webhook Integration
|
|
97
|
+
|
|
98
|
+
Send results to your SIEM or alerting system:
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
nox scan --webhook https://siem.example.com --webhook-token SECRET
|
|
102
|
+
nox purge --webhook https://siem.example.com --webhook-token SECRET
|
|
103
|
+
nox isolate --webhook https://siem.example.com --webhook-token SECRET
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
---
|
|
107
|
+
|
|
108
|
+
## Exit Codes
|
|
109
|
+
|
|
110
|
+
| Code | Status | Description |
|
|
111
|
+
|------|--------|-------------|
|
|
112
|
+
| 0 | `CLEAN` | Not detected |
|
|
113
|
+
| 1 | `DETECTED` | OpenClaw found |
|
|
114
|
+
| 2 | `ERROR` | Runtime error |
|
|
115
|
+
| 3 | `REMEDIATED` | Purge successful |
|
|
116
|
+
| 4 | `PURGE_FAILED` | Purge failed |
|
|
117
|
+
| 5 | `ISOLATED` | Isolation applied |
|
|
118
|
+
|
|
119
|
+
---
|
|
120
|
+
|
|
121
|
+
## Platform Support
|
|
122
|
+
|
|
123
|
+
- **macOS** — Full support (CLI, app bundle, launchd services)
|
|
124
|
+
- **Linux** — Full support (CLI, systemd services)
|
|
125
|
+
- **Windows** — Full support (CLI, Windows services)
|
|
126
|
+
|
|
127
|
+
---
|
|
128
|
+
|
|
129
|
+
## License
|
|
130
|
+
|
|
131
|
+
MIT
|
|
132
|
+
|
|
133
|
+
---
|
|
134
|
+
|
|
135
|
+
**Support:** arampeleschen@gmail.com, ilai.goldschmidt@gmail.com
|
|
136
|
+
**Issues:** [github.com/Arampc/Nox-OpenClaw-Hunter/issues](https://github.com/Arampc/Nox-OpenClaw-Hunter/issues)
|
|
137
|
+
|
|
138
|
+
---
|
|
139
|
+
|
|
140
|
+
**Nox Security™**
|
package/bin/nox.js
ADDED
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Nox Security branding constants and utilities.
|
|
3
|
+
*/
|
|
4
|
+
export declare const VERSION: string;
|
|
5
|
+
export declare const TOOL_NAME = "nox-openclaw-hunter";
|
|
6
|
+
export declare const DISPLAY_NAME = "Nox OpenClaw Hunter";
|
|
7
|
+
export declare const COMPANY = "Nox Security";
|
|
8
|
+
/**
|
|
9
|
+
* ASCII art banner for the CLI.
|
|
10
|
+
*/
|
|
11
|
+
export declare const BANNER_ART: string;
|
|
12
|
+
/**
|
|
13
|
+
* Print the Nox banner to console.
|
|
14
|
+
* @param showVersion - Whether to show the version line
|
|
15
|
+
*/
|
|
16
|
+
export declare function printBanner(showVersion?: boolean): void;
|
|
17
|
+
/**
|
|
18
|
+
* Exit codes for CLI.
|
|
19
|
+
*/
|
|
20
|
+
export declare const EXIT_CODES: {
|
|
21
|
+
/** OpenClaw not installed */
|
|
22
|
+
readonly CLEAN: 0;
|
|
23
|
+
/** OpenClaw detected */
|
|
24
|
+
readonly DETECTED: 1;
|
|
25
|
+
/** Script/runtime error */
|
|
26
|
+
readonly ERROR: 2;
|
|
27
|
+
/** Enforcement successful */
|
|
28
|
+
readonly REMEDIATED: 3;
|
|
29
|
+
/** Enforcement failed */
|
|
30
|
+
readonly ENFORCE_FAILED: 4;
|
|
31
|
+
/** Isolation applied */
|
|
32
|
+
readonly ISOLATED: 5;
|
|
33
|
+
};
|
|
34
|
+
export type ExitCode = typeof EXIT_CODES[keyof typeof EXIT_CODES];
|
|
35
|
+
/**
|
|
36
|
+
* Get exit code name for display.
|
|
37
|
+
*/
|
|
38
|
+
export declare function getExitCodeName(code: ExitCode): string;
|
|
39
|
+
//# sourceMappingURL=branding.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../src/branding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,eAAO,MAAM,OAAO,QAAc,CAAC;AAEnC,eAAO,MAAM,SAAS,wBAAwB,CAAC;AAC/C,eAAO,MAAM,YAAY,wBAAwB,CAAC;AAClD,eAAO,MAAM,OAAO,iBAAiB,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,UAAU,QAOtB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,UAAO,GAAG,IAAI,CAOpD;AAED;;GAEG;AACH,eAAO,MAAM,UAAU;IACrB,6BAA6B;;IAE7B,wBAAwB;;IAExB,2BAA2B;;IAE3B,6BAA6B;;IAE7B,yBAAyB;;IAEzB,wBAAwB;;CAEhB,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAElE;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAUtD"}
|
package/dist/branding.js
ADDED
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Nox Security branding constants and utilities.
|
|
3
|
+
*/
|
|
4
|
+
import chalk from 'chalk';
|
|
5
|
+
import { createRequire } from 'node:module';
|
|
6
|
+
const require = createRequire(import.meta.url);
|
|
7
|
+
const pkg = require('../package.json');
|
|
8
|
+
export const VERSION = pkg.version;
|
|
9
|
+
export const TOOL_NAME = 'nox-openclaw-hunter';
|
|
10
|
+
export const DISPLAY_NAME = 'Nox OpenClaw Hunter';
|
|
11
|
+
export const COMPANY = 'Nox Security';
|
|
12
|
+
/**
|
|
13
|
+
* ASCII art banner for the CLI.
|
|
14
|
+
*/
|
|
15
|
+
export const BANNER_ART = `
|
|
16
|
+
${chalk.cyan('███╗ ██╗ ██████╗ ██╗ ██╗')}
|
|
17
|
+
${chalk.cyan('████╗ ██║██╔═══██╗╚██╗██╔╝')}
|
|
18
|
+
${chalk.cyan('██╔██╗ ██║██║ ██║ ╚███╔╝ ')}
|
|
19
|
+
${chalk.cyan('██║╚██╗██║██║ ██║ ██╔██╗ ')}
|
|
20
|
+
${chalk.cyan('██║ ╚████║╚██████╔╝██╔╝ ██╗')}
|
|
21
|
+
${chalk.cyan('╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝')}
|
|
22
|
+
`;
|
|
23
|
+
/**
|
|
24
|
+
* Print the Nox banner to console.
|
|
25
|
+
* @param showVersion - Whether to show the version line
|
|
26
|
+
*/
|
|
27
|
+
export function printBanner(showVersion = true) {
|
|
28
|
+
console.log(BANNER_ART);
|
|
29
|
+
if (showVersion) {
|
|
30
|
+
console.log(chalk.bold(`OpenClaw Hunter v${VERSION}`));
|
|
31
|
+
console.log(chalk.dim(COMPANY));
|
|
32
|
+
console.log();
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
/**
|
|
36
|
+
* Exit codes for CLI.
|
|
37
|
+
*/
|
|
38
|
+
export const EXIT_CODES = {
|
|
39
|
+
/** OpenClaw not installed */
|
|
40
|
+
CLEAN: 0,
|
|
41
|
+
/** OpenClaw detected */
|
|
42
|
+
DETECTED: 1,
|
|
43
|
+
/** Script/runtime error */
|
|
44
|
+
ERROR: 2,
|
|
45
|
+
/** Enforcement successful */
|
|
46
|
+
REMEDIATED: 3,
|
|
47
|
+
/** Enforcement failed */
|
|
48
|
+
ENFORCE_FAILED: 4,
|
|
49
|
+
/** Isolation applied */
|
|
50
|
+
ISOLATED: 5,
|
|
51
|
+
};
|
|
52
|
+
/**
|
|
53
|
+
* Get exit code name for display.
|
|
54
|
+
*/
|
|
55
|
+
export function getExitCodeName(code) {
|
|
56
|
+
const names = {
|
|
57
|
+
[EXIT_CODES.CLEAN]: 'CLEAN',
|
|
58
|
+
[EXIT_CODES.DETECTED]: 'DETECTED',
|
|
59
|
+
[EXIT_CODES.ERROR]: 'ERROR',
|
|
60
|
+
[EXIT_CODES.REMEDIATED]: 'REMEDIATED',
|
|
61
|
+
[EXIT_CODES.ENFORCE_FAILED]: 'ENFORCE_FAILED',
|
|
62
|
+
[EXIT_CODES.ISOLATED]: 'ISOLATED',
|
|
63
|
+
};
|
|
64
|
+
return names[code] ?? 'UNKNOWN';
|
|
65
|
+
}
|
|
66
|
+
//# sourceMappingURL=branding.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"branding.js","sourceRoot":"","sources":["../src/branding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AAEnC,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAClD,MAAM,CAAC,MAAM,OAAO,GAAG,cAAc,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;EACxB,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;EACzC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;CAC1C,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,WAAW,GAAG,IAAI;IAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,6BAA6B;IAC7B,KAAK,EAAE,CAAC;IACR,wBAAwB;IACxB,QAAQ,EAAE,CAAC;IACX,2BAA2B;IAC3B,KAAK,EAAE,CAAC;IACR,6BAA6B;IAC7B,UAAU,EAAE,CAAC;IACb,yBAAyB;IACzB,cAAc,EAAE,CAAC;IACjB,wBAAwB;IACxB,QAAQ,EAAE,CAAC;CACH,CAAC;AAIX;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,KAAK,GAA6B;QACtC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO;QAC3B,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU;QACjC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO;QAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,YAAY;QACrC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,gBAAgB;QAC7C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU;KAClC,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAClC,CAAC"}
|
package/dist/cli.d.ts
ADDED
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* CLI entry point using Commander.js
|
|
3
|
+
*
|
|
4
|
+
* Registers all commands for the Nox OpenClaw Detector CLI.
|
|
5
|
+
*/
|
|
6
|
+
import { Command } from 'commander';
|
|
7
|
+
/**
|
|
8
|
+
* Create and configure the CLI program.
|
|
9
|
+
*/
|
|
10
|
+
export declare function createProgram(): Command;
|
|
11
|
+
/**
|
|
12
|
+
* Run the CLI.
|
|
13
|
+
*/
|
|
14
|
+
export declare function run(): Promise<void>;
|
|
15
|
+
//# sourceMappingURL=cli.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC;;GAEG;AACH,wBAAgB,aAAa,IAAI,OAAO,CA+EvC;AAED;;GAEG;AACH,wBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAGzC"}
|
package/dist/cli.js
ADDED
|
@@ -0,0 +1,94 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* CLI entry point using Commander.js
|
|
3
|
+
*
|
|
4
|
+
* Registers all commands for the Nox OpenClaw Detector CLI.
|
|
5
|
+
*/
|
|
6
|
+
import { Command } from 'commander';
|
|
7
|
+
import { VERSION, DISPLAY_NAME, COMPANY } from './branding.js';
|
|
8
|
+
import { scanCommand } from './commands/scan.js';
|
|
9
|
+
import { purgeCommand } from './commands/purge.js';
|
|
10
|
+
import { isolateApplyCommand, isolateRevertCommand, isolateListCommand, } from './commands/isolate.js';
|
|
11
|
+
import { exportCommand } from './commands/export.js';
|
|
12
|
+
/**
|
|
13
|
+
* Create and configure the CLI program.
|
|
14
|
+
*/
|
|
15
|
+
export function createProgram() {
|
|
16
|
+
const program = new Command();
|
|
17
|
+
program
|
|
18
|
+
.name('nox')
|
|
19
|
+
.description(`${DISPLAY_NAME} - Hunt, purge, and isolate OpenClaw by ${COMPANY}`)
|
|
20
|
+
.version(VERSION, '-v, --version', 'Output the current version')
|
|
21
|
+
.option('--debug', 'Enable debug logging');
|
|
22
|
+
// Scan command
|
|
23
|
+
program
|
|
24
|
+
.command('scan')
|
|
25
|
+
.description('Scan for OpenClaw installations')
|
|
26
|
+
.option('--all-users', 'Scan all user directories (requires sudo)')
|
|
27
|
+
.option('--port <port>', 'Gateway port to check (default: auto-detect)', parseInt)
|
|
28
|
+
.option('--json', 'Output JSON format')
|
|
29
|
+
.option('--yaml', 'Output YAML format')
|
|
30
|
+
.option('--webhook <url>', 'Send results to webhook URL')
|
|
31
|
+
.option('--webhook-token <token>', 'Bearer token for webhook authentication')
|
|
32
|
+
.option('-q, --quiet', 'Suppress banner and informational output')
|
|
33
|
+
.action(scanCommand);
|
|
34
|
+
// Purge command
|
|
35
|
+
program
|
|
36
|
+
.command('purge')
|
|
37
|
+
.description('Detect and remove OpenClaw (requires sudo, use --dry-run to preview)')
|
|
38
|
+
.option('--dry-run', 'Preview actions without executing')
|
|
39
|
+
.option('-f, --force', 'Skip confirmation prompts')
|
|
40
|
+
.option('--json', 'Output JSON format')
|
|
41
|
+
.option('--webhook <url>', 'Send results to webhook URL')
|
|
42
|
+
.option('--webhook-token <token>', 'Bearer token for webhook authentication')
|
|
43
|
+
.option('-q, --quiet', 'Suppress banner and informational output')
|
|
44
|
+
.action(purgeCommand);
|
|
45
|
+
// Isolate command with subcommands
|
|
46
|
+
const isolateCmd = program
|
|
47
|
+
.command('isolate')
|
|
48
|
+
.description('Isolate device from OpenClaw (requires sudo, use --dry-run to preview)')
|
|
49
|
+
.option('--port <port>', 'Specify port to block (default: auto-detect from scan)', parseInt)
|
|
50
|
+
.option('--dry-run', 'Preview actions without executing')
|
|
51
|
+
.option('--webhook <url>', 'Send isolation alert to webhook')
|
|
52
|
+
.option('--webhook-token <token>', 'Bearer token for webhook authentication')
|
|
53
|
+
.option('--json', 'Output JSON format')
|
|
54
|
+
.option('-f, --force', 'Skip confirmation prompts')
|
|
55
|
+
.option('-q, --quiet', 'Suppress banner and informational output')
|
|
56
|
+
.action(isolateApplyCommand);
|
|
57
|
+
// isolate revert
|
|
58
|
+
isolateCmd
|
|
59
|
+
.command('revert')
|
|
60
|
+
.description('Revert all isolation actions')
|
|
61
|
+
.option('--port <port>', 'Specify port to unblock (default: auto-detect)', parseInt)
|
|
62
|
+
.option('--dry-run', 'Preview actions without executing')
|
|
63
|
+
.option('--json', 'Output JSON format')
|
|
64
|
+
.option('-f, --force', 'Skip confirmation prompts')
|
|
65
|
+
.option('-q, --quiet', 'Suppress banner and informational output')
|
|
66
|
+
.action(isolateRevertCommand);
|
|
67
|
+
// isolate list
|
|
68
|
+
isolateCmd
|
|
69
|
+
.command('list')
|
|
70
|
+
.alias('ls')
|
|
71
|
+
.description('List quarantined items')
|
|
72
|
+
.option('--json', 'Output JSON format')
|
|
73
|
+
.option('-q, --quiet', 'Suppress banner')
|
|
74
|
+
.action(isolateListCommand);
|
|
75
|
+
// Export command
|
|
76
|
+
program
|
|
77
|
+
.command('export')
|
|
78
|
+
.description('Export MDM deployment scripts')
|
|
79
|
+
.requiredOption('--platform <platform>', 'MDM platform (jamf|intune|jumpcloud)')
|
|
80
|
+
.option('--mode <mode>', 'Script mode (detect|purge)', 'detect')
|
|
81
|
+
.option('--output <dir>', 'Output directory', './scripts')
|
|
82
|
+
.option('--webhook <url>', 'Include webhook URL in scripts')
|
|
83
|
+
.option('--webhook-token <token>', 'Include webhook token in scripts')
|
|
84
|
+
.action(exportCommand);
|
|
85
|
+
return program;
|
|
86
|
+
}
|
|
87
|
+
/**
|
|
88
|
+
* Run the CLI.
|
|
89
|
+
*/
|
|
90
|
+
export async function run() {
|
|
91
|
+
const program = createProgram();
|
|
92
|
+
await program.parseAsync(process.argv);
|
|
93
|
+
}
|
|
94
|
+
//# sourceMappingURL=cli.js.map
|
package/dist/cli.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,KAAK,CAAC;SACX,WAAW,CAAC,GAAG,YAAY,2CAA2C,OAAO,EAAE,CAAC;SAChF,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC;SAC/D,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAE7C,eAAe;IACf,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,aAAa,EAAE,2CAA2C,CAAC;SAClE,MAAM,CAAC,eAAe,EAAE,8CAA8C,EAAE,QAAQ,CAAC;SACjF,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;SACxD,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,CAAC;SAC5E,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,gBAAgB;IAChB,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,sEAAsE,CAAC;SACnF,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC;SACxD,MAAM,CAAC,aAAa,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;SACxD,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,CAAC;SAC5E,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,YAAY,CAAC,CAAC;IAExB,mCAAmC;IACnC,MAAM,UAAU,GAAG,OAAO;SACvB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,eAAe,EAAE,wDAAwD,EAAE,QAAQ,CAAC;SAC3F,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC;SACxD,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;SAC5D,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,CAAC;SAC5E,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,aAAa,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,iBAAiB;IACjB,UAAU;SACP,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,MAAM,CAAC,eAAe,EAAE,gDAAgD,EAAE,QAAQ,CAAC;SACnF,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC;SACxD,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,aAAa,EAAE,2BAA2B,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACjE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEhC,eAAe;IACf,UAAU;SACP,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC;SACxC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE9B,iBAAiB;IACjB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,cAAc,CAAC,uBAAuB,EAAE,sCAAsC,CAAC;SAC/E,MAAM,CAAC,eAAe,EAAE,4BAA4B,EAAE,QAAQ,CAAC;SAC/D,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,CAAC;SACzD,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;SAC3D,MAAM,CAAC,yBAAyB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC"}
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Export command - generate MDM deployment scripts.
|
|
3
|
+
*/
|
|
4
|
+
interface ExportCommandOptions {
|
|
5
|
+
platform: string;
|
|
6
|
+
mode: string;
|
|
7
|
+
output: string;
|
|
8
|
+
webhook?: string;
|
|
9
|
+
webhookToken?: string;
|
|
10
|
+
parent?: {
|
|
11
|
+
opts(): {
|
|
12
|
+
debug?: boolean;
|
|
13
|
+
};
|
|
14
|
+
};
|
|
15
|
+
}
|
|
16
|
+
/**
|
|
17
|
+
* Export command handler.
|
|
18
|
+
*/
|
|
19
|
+
export declare function exportCommand(options: ExportCommandOptions): Promise<void>;
|
|
20
|
+
export {};
|
|
21
|
+
//# sourceMappingURL=export.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/commands/export.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,UAAU,oBAAoB;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE;QACP,IAAI,IAAI;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC7B,CAAC;CACH;AAgjBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmFhF"}
|